condition

const (
	// S3TablesKMSKeyArn filters access by the AWS KMS key ARN used for S3 Tables encryption.
	S3TablesKMSKeyArn KeyName = "s3tables:KMSKeyArn"

	// S3TablesSSEAlgorithm filters access by the server-side encryption algorithm for S3 Tables.
	S3TablesSSEAlgorithm KeyName = "s3tables:SSEAlgorithm"

	// S3TablesNamespace filters access by the namespace within an S3 Tables bucket.
	S3TablesNamespace KeyName = "s3tables:namespace"

	// S3TablesTableName filters access by the S3 Tables table name within a namespace.
	S3TablesTableName KeyName = "s3tables:tableName"

	// S3TablesViewName filters access by the S3 Tables view name within a namespace.
	S3TablesViewName KeyName = "s3tables:viewName"

	// S3TablesFunctionName filters access by the S3 Tables function name within a namespace.
	S3TablesFunctionName KeyName = "s3tables:functionName"

	// S3TablesRegisterLocation filters access by the metadata location for table/view registration.
	S3TablesRegisterLocation KeyName = "s3tables:registerLocation"

	// S3TablesWarehouseTag filters access by tags on the table warehouse.
	S3TablesWarehouseTag KeyName = "s3tables:WarehouseTag"

	// S3TablesTableTag filters access by tags on the table.
	S3TablesTableTag KeyName = "s3tables:TableTag"

	// S3XAmzCopySource - key representing x-amz-copy-source HTTP header applicable to PutObject API only.
	S3XAmzCopySource KeyName = "s3:x-amz-copy-source"

	// S3XAmzServerSideEncryption - key representing x-amz-server-side-encryption HTTP header applicable
	// to PutObject API only.
	S3XAmzServerSideEncryption KeyName = "s3:x-amz-server-side-encryption"

	// S3XAmzServerSideEncryptionCustomerAlgorithm - key representing
	// x-amz-server-side-encryption-customer-algorithm HTTP header applicable to PutObject API only.
	S3XAmzServerSideEncryptionCustomerAlgorithm KeyName = "s3:x-amz-server-side-encryption-customer-algorithm"

	// S3XAmzMetadataDirective - key representing x-amz-metadata-directive HTTP header applicable to
	// PutObject API only.
	S3XAmzMetadataDirective KeyName = "s3:x-amz-metadata-directive"

	// S3XAmzContentSha256 - set a static content-sha256 for all calls for a given action.
	S3XAmzContentSha256 KeyName = "s3:x-amz-content-sha256"

	// S3XAmzStorageClass - key representing x-amz-storage-class HTTP header applicable to PutObject API
	// only.
	S3XAmzStorageClass KeyName = "s3:x-amz-storage-class"

	// S3XAmzServerSideEncryptionAwsKmsKeyID - key representing x-amz-server-side-encryption-aws-kms-key-id
	// HTTP header for S3 API calls
	S3XAmzServerSideEncryptionAwsKmsKeyID KeyName = "s3:x-amz-server-side-encryption-aws-kms-key-id"

	// S3XAmzObjectIfMatch - key representing the x-amz-object-if-match HTTP header used by the
	// object annotation APIs (PutObjectAnnotation/DeleteObjectAnnotation) for optimistic concurrency.
	S3XAmzObjectIfMatch KeyName = "s3:x-amz-object-if-match"

	// S3XAmzAnnotationDirective - key representing the x-amz-annotation-directive HTTP header
	// of CopyObject, which controls whether annotations are copied (COPY) or excluded (EXCLUDE).
	S3XAmzAnnotationDirective KeyName = "s3:x-amz-annotation-directive"

	// S3LocationConstraint - key representing LocationConstraint XML tag of CreateBucket API only.
	S3LocationConstraint KeyName = "s3:LocationConstraint"

	// S3Prefix - key representing prefix query parameter of ListBucket API only.
	S3Prefix KeyName = "s3:prefix"

	// S3Delimiter - key representing delimiter query parameter of ListBucket API only.
	S3Delimiter KeyName = "s3:delimiter"

	// MemoryPrefix - key representing the prefix query parameter of the AIStor
	// Memory list and search APIs. It scopes enumeration within a cortex, which
	// a resource ARN cannot express: a list names a query, not a record, so
	// putting the prefix in the resource path would make one ARN mean a single
	// record under a read action and a set of siblings under a list action.
	//
	// memory:Search takes it for the same reason and depends on it more, since
	// search returns object content: without the key its grant has only two
	// states, none or the whole cortex.
	MemoryPrefix KeyName = "memory:prefix"

	// MemoryMaxKeys - key representing the limit query parameter of the AIStor
	// Memory list APIs only. It caps a single page, bounding what one request
	// can enumerate.
	MemoryMaxKeys KeyName = "memory:max-keys"

	// S3VersionID - Enables you to limit the permission for the
	// s3:PutObjectVersionTagging action to a specific object version.
	S3VersionID KeyName = "s3:versionid"

	// S3MaxKeys - key representing max-keys query parameter of ListBucket API only.
	S3MaxKeys KeyName = "s3:max-keys"

	// S3ObjectLockRemainingRetentionDays - key representing object-lock-remaining-retention-days
	// Enables enforcement of an object relative to the remaining retention days, you can set
	// minimum and maximum allowable retention periods for a bucket using a bucket policy.
	// This key are specific for s3:PutObjectRetention API.
	S3ObjectLockRemainingRetentionDays KeyName = "s3:object-lock-remaining-retention-days"

	// S3ObjectLockMode - key representing object-lock-mode
	// Enables enforcement of the specified object retention mode
	S3ObjectLockMode KeyName = "s3:object-lock-mode"

	// S3ObjectLockRetainUntilDate - key representing object-lock-retain-util-date
	// Enables enforcement of a specific retain-until-date
	S3ObjectLockRetainUntilDate KeyName = "s3:object-lock-retain-until-date"

	// S3ObjectLockLegalHold - key representing object-local-legal-hold
	// Enables enforcement of the specified object legal hold status
	S3ObjectLockLegalHold KeyName = "s3:object-lock-legal-hold"

	// AWSReferer - key representing Referer header of any API.
	AWSReferer KeyName = "aws:Referer"

	// AWSSourceIP - key representing client's IP address (not intermittent proxies) of any API.
	AWSSourceIP KeyName = "aws:SourceIp"

	// AWSUserAgent - key representing UserAgent header for any API.
	AWSUserAgent KeyName = "aws:UserAgent"

	// AWSSecureTransport - key representing if the clients request is authenticated or not.
	AWSSecureTransport KeyName = "aws:SecureTransport"

	// AWSCurrentTime - key representing the current time.
	AWSCurrentTime KeyName = "aws:CurrentTime"

	// AWSEpochTime - key representing the current epoch time.
	AWSEpochTime KeyName = "aws:EpochTime"

	// AWSPrincipalType - user principal type currently supported values are "User" and "Anonymous".
	AWSPrincipalType KeyName = "aws:principaltype"

	// AWSUserID - user unique ID, in MinIO this value is same as your user Access Key.
	AWSUserID KeyName = "aws:userid"

	// AWSUsername - user friendly name, in MinIO this value is same as your user Access Key.
	AWSUsername KeyName = "aws:username"

	// AWSGroups - groups for any authenticating Access Key.
	AWSGroups KeyName = "aws:groups"

	// AWSSourceIdentity - the source identity of the session that signed the
	// request, set when the session was assumed and fixed for its lifetime.
	AWSSourceIdentity KeyName = "aws:SourceIdentity"

	// S3SignatureVersion - identifies the version of AWS Signature that you want to support for authenticated requests.
	S3SignatureVersion KeyName = "s3:signatureversion"

	// S3SignatureAge - identifies the maximum age of presgiend URL allowed
	S3SignatureAge KeyName = "s3:signatureAge"

	// S3AuthType - optionally use this condition key to restrict incoming requests to use a specific authentication method.
	S3AuthType KeyName = "s3:authType"

	// S3ExpressSessionMode - optionally use this condition key to control who can create a ReadWrite or ReadOnly session.
	S3ExpressSessionMode = "s3express:SessionMode"

	// Refer https://docs.aws.amazon.com/AmazonS3/latest/userguide/tagging-and-policies.html
	ExistingObjectTag    KeyName = "s3:ExistingObjectTag"
	RequestObjectTagKeys KeyName = "s3:RequestObjectTagKeys"
	RequestObjectTag     KeyName = "s3:RequestObjectTag"
)

const (
	// JWTSub - JWT subject claim substitution.
	JWTSub KeyName = "jwt:sub"

	// JWTIss issuer claim substitution.
	JWTIss KeyName = "jwt:iss"

	// JWTAud audience claim substitution.
	JWTAud KeyName = "jwt:aud"

	// JWTJti JWT unique identifier claim substitution.
	JWTJti KeyName = "jwt:jti"

	JWTUpn          KeyName = "jwt:upn"
	JWTName         KeyName = "jwt:name"
	JWTGroups       KeyName = "jwt:groups"
	JWTGivenName    KeyName = "jwt:given_name"
	JWTFamilyName   KeyName = "jwt:family_name"
	JWTMiddleName   KeyName = "jwt:middle_name"
	JWTNickName     KeyName = "jwt:nickname"
	JWTPrefUsername KeyName = "jwt:preferred_username"
	JWTProfile      KeyName = "jwt:profile"
	JWTPicture      KeyName = "jwt:picture"
	JWTWebsite      KeyName = "jwt:website"
	JWTEmail        KeyName = "jwt:email"
	JWTGender       KeyName = "jwt:gender"
	JWTBirthdate    KeyName = "jwt:birthdate"
	JWTPhoneNumber  KeyName = "jwt:phone_number"
	JWTAddress      KeyName = "jwt:address"
	JWTScope        KeyName = "jwt:scope"
	JWTClientID     KeyName = "jwt:client_id"
)

const (
	// LDAPUser - LDAP username, in MinIO this value is equal to your authenticating LDAP user DN.
	LDAPUser KeyName = "ldap:user"

	// LDAPUsername - LDAP username, in MinIO is the authenticated simple user.
	LDAPUsername KeyName = "ldap:username"

	// LDAPGroups - LDAP groups, in MinIO this value is equal LDAP Group DNs for the authenticating user.
	LDAPGroups KeyName = "ldap:groups"
)

const (
	// STSDurationSeconds - Duration seconds condition for STS policy
	STSDurationSeconds KeyName = "sts:DurationSeconds"

	// STSSourceIdentity - the source identity the session being assumed will
	// carry: the one requested, or the one inherited from the caller's session.
	STSSourceIdentity KeyName = "sts:SourceIdentity"

	// SVCDurationSeconds - Duration seconds condition for Admin policy
	SVCDurationSeconds KeyName = "svc:DurationSeconds"

	// AdminPolicyName - the name of the policy a policy admin action
	// (admin:CreatePolicy, admin:DeletePolicy, admin:GetPolicy) works on, so a
	// statement can grant those actions on a set of policies, for example
	// StringLike {"admin:PolicyName": ["app-*"]}.
	AdminPolicyName KeyName = "admin:PolicyName"
)